OPA-Istio Kubernetes - Does the sidecar OPA read from the admission controller cache?

[Thomas-Rice]

Hi,
I've injected data into the admission controller, but when i create a new deployment with a sidecar OPA, I cannot seem to get the data that is stored in the admission controllers cache.
Would anyone know how this works? If the sidecars are meant to be their own isolated OPA or talk to the central admission controller for the data?

[anderseknert]

Hi Thomas! 🙂 I'm not sure what you are referring to as an admission controller here. Are you using OPA for Kubernetes admission control as well? That deployment would normally be kept separate from any other type of OPA deployments in you cluster. What data from the admission controller would you want to make available in you sidecars?

[Thomas-Rice]

Ok fantastic,
I really appreciate you clearing that up for me :)

So just to clarify,
I'm already reading my policy from an S3 bucket, so if I bundle my data with that, then the sidecars will be able to read that data?

[anderseknert]

Indeed! You could just configure your sidecar OPAs to either fetch the same bundle as your admission controller, or you could build a bundle for your sidecars with only policy and data relevant for those. I'd probably go with the latter in order to isolate the two from each other, even if the data will be similar / identical.

[Thomas-Rice]

Thank you so much for the advice!

[Thomas-Rice]

Are there any examples on how to get a sidecar to read a specific bundle?

[anderseknert]

You'd just start it with a configuration pointing to any given bundle at a remote endpoint: https://www.openpolicyagent.org/docs/latest/configuration/#example